---
title: "A Simple and Efficient Learning-Style Prompting for LLM"
description: "The authors propose HILL (Hiding Intention by Learning from LLMs), a deterministic, model-agnostic method for rewriting a… 39 references."
authors: ["Xuan Luo", "Yue Wang", "Zefeng He", "Geng Tu", "Jing Li", "Ruifeng Xu"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: EACL 2026"
source: "https://aclanthology.org/2026.findings-eacl.124/"
doi: "10.18653/v1/2026.findings-eacl.124"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/luo-2026-simple-efficient-learning-style-prompting/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/luo-2026-simple-efficient-learning-style-prompting/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/20/) / A Simple and Efficient Learning-Style Prompting for LLM Jailbreaking

# A Simple and Efficient Learning-Style Prompting for LLM Jailbreaking

**Authors:** [Xuan Luo](https://md.research.elamur.ai/free/en/authors/xuan-luo/), [Yue Wang](https://md.research.elamur.ai/free/en/authors/yue-wang/), Zefeng He, Geng Tu, [Jing Li](https://md.research.elamur.ai/free/en/authors/jing-li/) and [Ruifeng Xu](https://md.research.elamur.ai/free/en/authors/ruifeng-xu/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: EACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-eacl.124/) · [PDF](https://aclanthology.org/2026.findings-eacl.124.pdf) · [DOI 10.18653/v1/2026.findings-eacl.124](https://doi.org/10.18653/v1/2026.findings-eacl.124) · [OpenAlex](https://openalex.org/W7140100226)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
The paper identifies a safety gap in current LLMs: harmful requests rewritten to look like ordinary educational questions often get past alignment safeguards. The authors propose HILL (Hiding Intention by Learning from LLMs), a deterministic, model-agnostic method for rewriting a harmful goal as a curiosity-driven academic question. It builds on four components: a key concept, an exploratory transformation, a detail-oriented inquiry, and an optional hypothetical framing. The approach draws on indirect-questioning techniques from social psychology and survey research. The authors also introduce new metrics for how efficient and how harmful jailbreak prompts are. They test HILL on AdvBench across 22 models against prompting-based baselines. HILL reaches the highest attack success on most models and malicious categories while using much shorter prompts. Most prompt-level defenses help little, and some even raise success rates. A control set of safe prompts shows that models and defenses rely on surface wording rather than real intent. This highlights a basic tension between helpfulness and safety alignment, and it questions whether ASR is a valid way to evaluate defenses.

## Key points
- HILL prompts average about 24.94 words, compared with 59–986 words for MasterKey, PAIR, PAP, and DrAttack. Its proposed Efficiency score is 3.01, versus 0.86 for PAP and 0.05 for DrAttack.
- Evaluation uses AdvBench across 22 LLMs, with baselines including PAP, PAIR, MasterKey, and DrAttack. Only black-box attacks are considered.
- A generic hypothetical cue, such as a single word or a movie framing, is enough for transferable success. No elaborate scenario or role-play is needed.
- Tested defenses were Rand Drop, Rand Insert, Rand Swap, Rand Patch, Paraphrase, Goal Prioritization, and Intention Analysis. Most showed mediocre effect against HILL.
- On safe control prompts derived from AdvBench, models such as DeepSeek, GPT, Qwen, Mixtral, and Claude refused more often than they did for HILL prompts, with a gap of roughly 20%. Semantic defenses made over-refusal worse.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Harbin Institute of Technology](https://md.research.elamur.ai/free/en/universities/harbin-institute-of-technology/) — University, Harbin, China · 158 works · 28,841 citations
- [Hong Kong Polytechnic University](https://md.research.elamur.ai/free/en/universities/hong-kong-polytechnic-university/) — University, Hong Kong, China · 84 works · 4,956 citations
- [Shenzhen University](https://md.research.elamur.ai/free/en/universities/shenzhen-university/) — University, Shenzhen, China · 16 works · 95 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 517 works

## Cite

Cite as: Xuan Luo, Yue Wang, Zefeng He, Geng Tu, Jing Li and Ruifeng Xu. 2026. A Simple and Efficient Learning-Style Prompting for LLM Jailbreaking. Findings of the Association for Computational Linguistics: EACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{luo2026simple,
  title = {{A Simple and Efficient Learning-Style Prompting for LLM Jailbreaking}},
  author = {Xuan Luo, Yue Wang, Zefeng He, Geng Tu, Jing Li and Ruifeng Xu},
  booktitle = {Findings of the Association for Computational Linguistics: EACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-eacl.124},
  url = {https://doi.org/10.18653/v1/2026.findings-eacl.124}
}
```

- [← previous A Severity-Based Curriculum Learning Strategy for Arabic Medical Text Generation](https://md.research.elamur.ai/free/en/papers/alansary-2026-severity-based-curriculum-learning-strategy/)
- [next → A Single Model Ensemble Framework for Neural Machine Translation Using Pivot Translation](https://md.research.elamur.ai/free/en/papers/oh-2026-single-model-ensemble-framework-neural/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/20/)

## References

39 references, 18 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Alibaba Cloud. 2024. Qwen2.5-omni-7b. [https://huggingface.co/Qwen/Qwen2.5-Omni-7B](https://huggingface.co/Qwen/Qwen2.5-Omni-7B). Accessed: 2025-07-15. [↗](https://huggingface.co/Qwen/Qwen2.5-Omni-7B)
2. Anthropic. 2024. Introducing claude 4. [https://www.anthropic.com/news/claude-4](https://www.anthropic.com/news/claude-4). Accessed: 2025-07-15. [↗](https://www.anthropic.com/news/claude-4)
3. Usman Anwar, Abulhair Saparov, Javier Rando, Daniel Paleka, Miles Turpin, Peter Hase, Ekdeep Singh Lubana, Erik Jenner, Stephen Casper, Oliver Sourbut, and 1 others. 2024. Foundational challenges in assuring alignment and safety of large language models. Transactions on Machine Learning Research, 20… [find](https://scholar.google.com/scholar?q=Usman+Anwar%2C+Abulhair+Saparov%2C+Javier+Rando%2C+Daniel+Paleka%2C+Miles+Turpin%2C+Peter+Hase%2C+Ekdeep+Singh+Lubana%2C+Erik+Jenner%2C+Stephen+Casper%2C+Oliver+Sourbut%2C+and+1+others%2E+2024%2E+Foundational+challenges+in+a)
4. Baidu. 2024. Ernie bot. [https://ernie.baidu.com/](https://ernie.baidu.com/). Accessed: 2025-07-15. [↗](https://ernie.baidu.com/)
5. Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. [Language models are few-shot learners](https://md.research.elamur.ai/free/en/papers/brown-2020-language-models-few-shot-learners/). In Advances in Neural Information Processing Systems, volume 33, pages 1877–1901.
6. ByteDance. 2025. Doubao-1.5-pro. [https://seed.bytedance.com/en/special/doubao_1_5_pro](https://seed.bytedance.com/en/special/doubao_1_5_pro). Accessed: 2025-07-15. [↗](https://seed.bytedance.com/en/special/doubao_1_5_pro)
7. Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. 2024. [Defending against alignment-breaking attacks via robustly aligned llm](https://md.research.elamur.ai/free/en/papers/cao-2024-defending-against-alignment-breaking-attacks/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 10542– 10560.
8. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2025. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE.
9. Beatriz Cobo, Eva Castillo, Francisca López-Torrecillas, and María Del Mar Rueda. 2021. Indirect questioning methods for sensitive survey questions: Modelling criminal behaviours among a prison population. PloS one, 16(1):e0245550. [find](https://scholar.google.com/scholar?q=Beatriz+Cobo%2C+Eva+Castillo%2C+Francisca+L%C3%B3pez%2DTorrecillas%2C+and+Mar%C3%ADa+Del+Mar+Rueda%2E+2021%2E+Indirect+questioning+methods+for+sensitive+survey+questions%3A+Modelling+criminal+behaviours+among+a+prison+popula)
10. Tiehan Cui, Yanxu Mao, Peipei Liu, Congying Liu, and Datao You. 2025. Exploring jailbreak attacks on llms through intent concealment and diversion. arXiv eprints, pages arXiv–2505. [find](https://scholar.google.com/scholar?q=Tiehan+Cui%2C+Yanxu+Mao%2C+Peipei+Liu%2C+Congying+Liu%2C+and+Datao+You%2E+2025%2E+Exploring+jailbreak+attacks+on+llms+through+intent+concealment+and+diversion%2E+arXiv+eprints%2C+pages+arXiv%E2%80%932505%2E)
11. DeepSeek-AI. 2024a. Deepseek-v2: A strong, economical, and efficient mixture-of-experts language model. Preprint, arXiv:2405.04434. [find](https://scholar.google.com/scholar?q=DeepSeek%2DAI%2E+2024a%2E+Deepseek%2Dv2%3A+A+strong%2C+economical%2C+and+efficient+mixture%2Dof%2Dexperts+language+model%2E+Preprint%2C+arXiv%3A2405%2E04434%2E)
12. DeepSeek-AI. 2024b. Deepseek-v3 technical report. Preprint, arXiv:2412.19437. [find](https://scholar.google.com/scholar?q=DeepSeek%2DAI%2E+2024b%2E+Deepseek%2Dv3+technical+report%2E+Preprint%2C+arXiv%3A2412%2E19437%2E)
13. DeepSeek-AI. 2025. [Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/). Preprint, arXiv:2501.12948.
14. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024. Masterkey: Automated jailbreaking of large language model chatbots. In NDSS. [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2024%2E+Masterkey%3A+Automated+jailbreaking+of+large+language+model+chatbots%2E+In+NDSS%2E)
15. Allen L Edwards. 1953. The relationship between the judged desirability of a trait and the probability that the trait will be endorsed. Journal of applied Psychology, 37(2):90. [find](https://scholar.google.com/scholar?q=Allen+L+Edwards%2E+1953%2E+The+relationship+between+the+judged+desirability+of+a+trait+and+the+probability+that+the+trait+will+be+endorsed%2E+Journal+of+applied+Psychology%2C+37%282%29%3A90%2E)
16. Gemma Team and 1 others. 2025. Gemma 3 technical report. Preprint, arXiv:2503.19786. [find](https://scholar.google.com/scholar?q=Gemma+Team+and+1+others%2E+2025%2E+Gemma+3+technical+report%2E+Preprint%2C+arXiv%3A2503%2E19786%2E)
17. Google and 1 others. 2023. [Gemini: A family of highly capable multimodal models](https://md.research.elamur.ai/free/en/papers/gemini-team-2023-gemini-family-highly-capable-multimodal/). Preprint, arXiv:2312.11805.
18. Google and 1 others. 2024. [Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities](https://md.research.elamur.ai/free/en/papers/comanici-2025-gemini-2-5-pushing-frontier/). Google DeepMind Technical Report. Accessed: 2025-07-15.
19. Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho-Jui Hsieh. 2024. Drattack: Prompt decomposition and reconstruction makes powerful llms jailbreakers. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 13891– 13913. [find](https://scholar.google.com/scholar?q=Xirui+Li%2C+Ruochen+Wang%2C+Minhao+Cheng%2C+Tianyi+Zhou%2C+and+Cho%2DJui+Hsieh%2E+2024%2E+Drattack%3A+Prompt+decomposition+and+reconstruction+makes+powerful+llms+jailbreakers%2E+In+Findings+of+the+Association+for+Compu)
20. Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hang Li. 2023. [Trustworthy llms: a survey and guideline for evaluating large language models’ alignment](https://md.research.elamur.ai/free/en/papers/liu-2023-trustworthy-llms-survey-guideline-evaluating/). In Socially Responsible Language Modelling Research.
21. Llama Team. 2024. [The llama3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). Preprint, arXiv:2407.21783.
22. Microsoft. 2023. microsoft/phi-2. huggingface.co/microsoft/phi-2. 2025-07-15. https://Accessed: OpenAI. 2024. [Openai o1 system card](https://md.research.elamur.ai/free/en/papers/openai-2024-openai-o1-system-card/). Preprint, arXiv:2412.16720.
23. OpenAI. 2025. Early external safety testing of openai’s o3-mini: Insights from the pre-deployment evaluation. [https://cdn.openai.com/pdf/](https://cdn.openai.com/pdf/) 2221c875-02dc-4789-800b-e7758f3722c1/ o3-and-o4-mini-system-card.pdf. [↗](https://cdn.openai.com/pdf/)
24. OpenAI and 1 others. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). Preprint, arXiv:2303.08774.
25. OpenAI and 1 others. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). Preprint, arXiv:2410.21276.
26. Rui Pu, Chaozhuo Li, Rui Ha, Litian Zhang, Lirong Qiu, and Xi Zhang. 2024. Baitattack: Alleviating intention shift in jailbreak attacks via adaptive bait crafting. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 15654–15668. [find](https://scholar.google.com/scholar?q=Rui+Pu%2C+Chaozhuo+Li%2C+Rui+Ha%2C+Litian+Zhang%2C+Lirong+Qiu%2C+and+Xi+Zhang%2E+2024%2E+Baitattack%3A+Alleviating+intention+shift+in+jailbreak+attacks+via+adaptive+bait+crafting%2E+In+Proceedings+of+the+2024+Conferenc)
27. Qwen Team. 2024. Qwen2.5: A party of foundation models. [https://qwenlm.github.io/blog/](https://qwenlm.github.io/blog/) qwen2.5/. Accessed: 2025-07-15. [↗](https://qwenlm.github.io/blog/)
28. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). Preprint, arXiv:2309.00614.
29. Qwen Team. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). Preprint, arXiv:2505.09388.
30. Albert Jiang, Alexandre Boyer, Paul L’Hostis, Gabriel Mou, Quentin Rabe, Ronan Reizenstein, Stanislas Scao, Lauri Tachard, Yacine de La Sayette, Pierre Lacroix, and 1 others. 2024. Mixtral of experts. Preprint, arXiv:2401.04088. [find](https://scholar.google.com/scholar?q=Albert+Jiang%2C+Alexandre+Boyer%2C+Paul+L%E2%80%99Hostis%2C+Gabriel+Mou%2C+Quentin+Rabe%2C+Ronan+Reizenstein%2C+Stanislas+Scao%2C+Lauri+Tachard%2C+Yacine+de+La+Sayette%2C+Pierre+Lacroix%2C+and+1+others%2E+2024%2E+Mixtral+of+experts%2E)
31. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2024. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. arXiv eprints, pages arXiv–2404. [find](https://scholar.google.com/scholar?q=Mark+Russinovich%2C+Ahmed+Salem%2C+and+Ronen+Eldan%2E+2024%2E+Great%2C+now+write+an+article+about+that%3A+The+crescendo+multi%2Dturn+llm+jailbreak+attack%2E+arXiv+eprints%2C+pages+arXiv%E2%80%932404%2E)
32. Linbao Li, Yannan Liu, Daojing He, and YU LI. 2025. One model transfer to all: On robust jailbreak prompts generation against llms. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Linbao+Li%2C+Yannan+Liu%2C+Daojing+He%2C+and+YU+LI%2E+2025%2E+One+model+transfer+to+all%3A+On+robust+jailbreak+prompts+generation+against+llms%2E+In+The+Thirteenth+International+Conference+on+Learning+Representatio)
33. Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. [Smoothllm: Defending large large language models against jailbreaking attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/). Preprint, arXiv:2310.03684.
34. Shang Shang, Zhongjiang Yao, Yepeng Yao, Liya Su, Zijing Fan, Xiaodan Zhang, and Zhengwei Jiang. 2024. Intentobfuscator: a jailbreaking method via confusing llm with prompts. In European Symposium on Research in Computer Security, pages 146–165. Springer. [find](https://scholar.google.com/scholar?q=Shang+Shang%2C+Zhongjiang+Yao%2C+Yepeng+Yao%2C+Liya+Su%2C+Zijing+Fan%2C+Xiaodan+Zhang%2C+and+Zhengwei+Jiang%2E+2024%2E+Intentobfuscator%3A+a+jailbreaking+method+via+confusing+llm+with+prompts%2E+In+European+Symposium+on+)
35. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. Jailbreak attacks and defenses against [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). CoRR.
36. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
37. Yuqi Zhang, Liang Ding, Lefei Zhang, and Dacheng Tao. 2024a. Intention analysis prompting makes large language models a good jailbreak defender. Preprint, arXiv:2401.06561. — [arXiv:2401.06561](https://arxiv.org/abs/2401.06561) [find](https://scholar.google.com/scholar?q=Yuqi+Zhang%2C+Liang+Ding%2C+Lefei+Zhang%2C+and+Dacheng+Tao%2E+2024a%2E+Intention+analysis+prompting+makes+large+language+models+a+good+jailbreak+defender%2E+Preprint%2C+arXiv%3A2401%2E06561%2E+%E2%80%94+%5BarXiv%3A2401%2E06561%5D%28https%3A)
38. Zhexin Zhang, Junxiao Yang, Pei Ke, Fei Mi, Hongning Wang, and Minlie Huang. 2024b. [Defending large language models against jailbreaking attacks through goal prioritization](https://md.research.elamur.ai/free/en/papers/zhang-2024-defending-large-language-models-against/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8865…
39. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Padlewski, Xiaoxia Li, Xuan Zhuang, Yonghao Wu, Hao Li, Zi Li, Joseph Zou, and 1 others. 2023. [Judging llm as a judge with mt-bench and chatbot arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/). Preprint, arXiv:2306.05685.

*Updated 1 November 2026*